4 ms·
This has to be malware in poor disguise. Curl-bash without hash-checking from a four-month-old domain with full k8s cluster access? All the identities connecte
by dantillberg 10mo ago
This has to be malware in poor disguise.
Curl-bash without hash-checking from a four-month-old domain with full k8s cluster access? All the identities connected are brand new, including the brand-new HN account that posted this. There are four commits in the repo, and three are back-dated to exactly 1 year ago.
- unsnap_biceps 10mo agoAnd it's possible to serve different content if the curl is being piped to a shell vs if it's being piped to a file or stdout https://github.com/Stijn-K/curlbash_detect https://github.com/Stijn-K/curlbash_detect
- wozzio 10mo agoThe curl | bash is just for convenience; the README explicitly advises to Download and inspect wozz.sh first if you aren't comfortable piping to shell. As for the newness I just open-sourced this from my personal scripts collection this week, so yes, the Org and Account are new. It runs entirely locally using your active kubeconfig it doesn't collect credentials or send secrets anywhere. You can cat the script to verify that it's just a wrapper around kubectl top and kubectl get.